]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ipv6: fix possible infinite loop in fib6_info_uses_dev()
authorEric Dumazet <edumazet@google.com>
Fri, 25 Jul 2025 14:07:24 +0000 (14:07 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Aug 2025 10:08:50 +0000 (12:08 +0200)
commit9cb6de8ee144a94ae7a40bdb32560329ab7276f0
tree100fbf81bd71ca379021f23eb27866388e27eadd
parente1b7932af47f92432be8303d2439d1bf77b0be23
ipv6: fix possible infinite loop in fib6_info_uses_dev()

[ Upstream commit f8d8ce1b515a0a6af72b30502670a406cfb75073 ]

fib6_info_uses_dev() seems to rely on RCU without an explicit
protection.

Like the prior fix in rt6_nlmsg_size(),
we need to make sure fib6_del_route() or fib6_add_rt2node()
have not removed the anchor from the list, or we risk an infinite loop.

Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv6/route.c